VYPR
← All advisories
High severityNVD Advisory· Published Oct 19, 2022· Updated May 8, 2025

CVE-2022-43416

CVE-2022-43416

Description

Jenkins Katalon Plugin 1.0.32 and earlier allows agent-to-controller command execution, enabling attackers with agent control to run arbitrary OS commands on the controller.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins Katalon Plugin 1.0.32 and earlier allows agent-to-controller command execution, enabling attackers with agent control to run arbitrary OS commands on the controller.

Vulnerability

Description

The Jenkins Katalon Plugin versions 1.0.32 and earlier implement an agent/controller message that does not restrict where it can be executed. This message allows invoking Katalon with attacker-controlled version, install location, and arguments. The root cause is the use of hudson.remoting.Callable without proper role checking, as shown in the fix commit [4].

Exploitation

An attacker who can control an agent process (e.g., by having Agent/Configure permission or compromising an agent) can send this message to the Jenkins controller. If the attacker also has the ability to create files on the controller (for example, attackers with Item/Configure permission could archive artifacts), they can achieve arbitrary OS command execution by crafting arguments that invoke commands [1][3].

Impact

Successful exploitation allows an attacker to execute arbitrary operating system commands on the Jenkins controller, leading to full compromise of the Jenkins instance and potential lateral movement within the network [2].

Mitigation

The vulnerability is fixed in Katalon Plugin versions 1.0.33 and 1.0.34 [1][2]. Users should upgrade to these versions immediately. No workaround is available.

References
  1. Jenkins Security Advisory 2022-10-19
  2. security - Multiple vulnerabilities in Jenkins plugins
  3. NVD - CVE-2022-43416
  4. Merge pull request #27 from Minh-Chien/master · jenkinsci/katalon-plugin@0ee4b34

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:katalonMaven
< 1.0.331.0.33

Affected products

2

Patches

1
0ee4b34afdcb

Merge pull request #27 from Minh-Chien/master

https://github.com/jenkinsci/katalon-pluginDuy LuongSep 30, 2022via ghsa
commit
1 file changed · +2 −6
  • src/main/java/com/katalon/jenkins/plugin/helper/ExecuteKatalonStudioHelper.java+2 −6 modified
    @@ -7,8 +7,7 @@
 import hudson.FilePath;
 import hudson.Launcher;
 import hudson.model.TaskListener;
-import hudson.remoting.Callable;
-import org.jenkinsci.remoting.RoleChecker;
+import jenkins.security.MasterToSlaveCallable;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -27,7 +26,7 @@ public static boolean executeKatalon(
             String xvfbConfiguration) {
         Logger logger = new JenkinsLogger(taskListener);
         try {
-            return launcher.getChannel().call(new Callable<Boolean, Exception>() {
+            return launcher.getChannel().call(new MasterToSlaveCallable<Boolean, Exception>() {
                 @Override
                 public Boolean call() throws Exception {
 
@@ -54,9 +53,6 @@ public Boolean call() throws Exception {
                     }
                     return true;
                 }
-                @Override
-                public void checkRoles(RoleChecker roleChecker) throws SecurityException {
-                }
             });
         } catch (Exception e) {
             String stackTrace = Throwables.getStackTraceAsString(e);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.